I have a rsyslog Server which have the below settings,Where its getting all the remote Linux systems logs and network logs.
# cat /etc/rsyslog.conf
$ModLoad imudp
$UDPServerRun 514
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template noida-dc, "/scratch/rsyslog/%HOSTNAME%/messages.log"
authpriv.* ?noida-dc
*.info,mail.none,authpriv.none,cron.none ?noida-dc
$IncludeConfig /etc/rsyslog.d/*.conf
Whereas Linux system logs are log as they are storing into /scratch/rsyslog
with their hostames by creating a directory with hostnames itself and then creating a message file within it, that's fine.
However, i want to segregate the network logs which basically creates a Folder by Month names like Jan Feb Mar
and then creates a message.log
as well but as network logs do not have hostnames it Just creating a dir based on the moth name and keeping the only one file into it thats messages.log
, my wish is to have these network logs to a different Directory like /scratch/network
.
Below is message format within the network log directory Dec
Dec 2 19:04:22 Dec 02 13:34:22.768 cisco-apic-1 %LOG_-3-SYSTEM_MSG
So, Is there a way to tell rsyslog if remote message contains Dec
or Jan
then must go to /scratch/network
.
What i tried as Follows but not working.
$template mynets,"/scratch/network/%HOSTNAME%/messages.log"
if $fromhost contains 'cisco-apic-1' then -?mynets
& stop
&
$template mynets,"/scratch/network/%HOSTNAME%/messages.log"
if $fromhost startswith 'Dec' then -?mynets
& stop
Linux Distro is : Centos 6